Publish VM receiving authority atomically
TE
3h ago+1284+1284+0123456789012345678901234567890123456789-101-101-012345678901234567890123456789
Publish authenticated VM receiver keys, policy and issuer time together while retaining replay history. Refreshes are fenced to their owner and intent: late replies or failures cannot reopen or clear newer authority. A bounded client validates the protected agent socket and original public VM identity.
Hosted Linux passes 102 receiver cases, fmt/Clippy and Rust 1.91; macOS is queued. Baseline reproduced four failures. Supervised listener and private key bootstrap remain follow-ups.
Changelog
none